Installing pnpm 10.1.0 on windows fails with `cannot find matching keyid`

[akaltar]

Verify latest release

• I verified that the issue exists in the latest pnpm release

pnpm version

10.1.0

Which area(s) of pnpm are affected? (leave empty if unsure)

Operating System (Windows, MacOS, Linux)

Link to the code that reproduces this issue or a replay of the bug

No response

Reproduction steps

corepack install --global pnpm@10.1.0
or even pnpm self-update fails

Oddly installing any other pnpm version seems to work, and the error isn't the same as when trying to install a non-existent version

Describe the Bug

Internal Error: Cannot find matching keyid: {"signatures":[{"sig":"MEUCIQDlkgmNyZjT7KUY8AO6jH7Gs3fyiXG8nbTnuLbd8fOS2AIgXyJ6SaYhumMFzUYQAZPJGhsnlaD5N0X2MZsbG+eS/Xo=","keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U"}],"keys":[{"expires":null,"keyid":"SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA","keytype":"ecdsa-sha2-nistp256","scheme":"ecdsa-sha2-nistp256","key":"MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAE1Olb3zMAFFxXKHiIkQO5cJ3Yhl5i6UPp+IhuteBJbuHcA5UogKo0EWtlWwW6KSaKoTNEYL7JlCQiVnkhBktUgg=="}]}
    at verifySignature (C:\Program Files\nodejs\node_modules\corepack\dist\lib\corepack.cjs:22688:11)
    at installVersion (C:\Program Files\nodejs\node_modules\corepack\dist\lib\corepack.cjs:23037:7)
    at process.processTicksAndRejections (node:internal/process/task_queues:95:5)
    at async Engine.ensurePackageManager (C:\Program Files\nodejs\node_modules\corepack\dist\lib\corepack.cjs:23449:32)
    at async InstallGlobalCommand.installFromDescriptor (C:\Program Files\nodejs\node_modules\corepack\dist\lib\corepack.cjs:23846:5)
    at async InstallGlobalCommand.execute (C:\Program Files\nodejs\node_modules\corepack\dist\lib\corepack.cjs:23828:9)
    at async InstallGlobalCommand.validateAndExecute (C:\Program Files\nodejs\node_modules\corepack\dist\lib\corepack.cjs:20954:22)
    at async _Cli.run (C:\Program Files\nodejs\node_modules\corepack\dist\lib\corepack.cjs:21929:18)
    at async Object.runMain (C:\Program Files\nodejs\node_modules\corepack\dist\lib\corepack.cjs:24227:18)

Expected Behavior

pnpm 10.1.0 gets installed

Which Node.js version are you using?

Node.js v22.1.0

Which operating systems have you used?

• macOS
• Windows
• Linux

If your OS is a Linux based, which one it is? (Include the version if relevant)

No response

[MikeMcC399]

• This issue is also reported in Newly published versions of package managers distributed from npm cannot be installed due to key id mismatch nodejs/corepack#612

It affects all operating systems

[wraithgar]

https://registry.npmjs.org/-/npm/v1/keys should now be returning two keys. During key rotation the old one was omitted by mistake and has since been re-added. CDN caching will of course take a little time to catch up but both the SHA256:jl3bwswu80PjjokCgh0o2w5c2U4LhQAE57gj9cz1kzA key (which was used to sign tarballs up until last week) and the SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U key (which is being used going forward) are both in that endpoint, which should allow folks to verify signatures again.

[MikeMcC399]

Although the keys have been fixed (thanks @wraithgar !) the issue still persists as it appears that Corepack is not dealing with the two keys as needed.

• See Newly published versions of package managers distributed from npm cannot be installed due to key id mismatch nodejs/corepack#612 for latest information.

[MikeMcC399]

@akaltar

There has been a new release corepack@0.31.0 with updated npm keys.

After a manual install:

npm install -g corepack@latest

I was then able to execute the following successfully:

corepack use pnpm@10.1.0

[akaltar]

In any case this wasn't an issue with pnpm directly. Thanks!

[zkochan]

Szia! Great to see that people started using v10. I am still a bit terrified to make it latest due to the big change with blocking scripts of dependencies by default.

[akaltar]

Szia!
I've found it very easy to upgrade in cases where we were already on pnpm 9, since on install it lists all blocked scripts, it's very easy to just add them to the "onlyBuiltDependencies" array.

I've actually had more issues with eslint breaking where we haven't updated to eslint 9 yet. Even when I knew the issue it required a bit of fiddling, because the syntax and location where you specify the public hoist pattern was very odd + because in some cases it was due to a missing package in the package.json in a monorepo

Another possible breakage I can see is people relying on the post-install scripts being run regardless of packages needing update, although we haven't seen this yet. For example we had a graphql generation on post-install and I can imagine it taking some people by surprise that it doesn't run due to the new caching.

And last but not least even with the corepack update fixing 10.1.0 in theory, on windows there is no neat way to update corepack, npm install -g or pnpm install -g doesn't replace the initial command, but that's again a separate issue unrelated to pnpm.

[MikeMcC399]

Workaround for keyid issues using Corepack 0.27.0 to 0.30.0 releases with pnpm@10.1.0:

Bash

SHA_SUM=$(npm view pnpm@10.1.0 dist.shasum)
corepack install -g pnpm@10.1.0+sha1.$SHA_SUM

Windows PowerShell

$SHA_SUM = npm view pnpm@10.1.0 dist.shasum
corepack install -g pnpm@10.1.0+sha1.$SHA_SUM

This may be needed for pnpm releases after 10.1.0 until an update of Corepack is packaged with Node.js and released. Just replace the pnpm version in the above shell script snippets with any new version.

[leonhelmus]

Thanks for the solution @MikeMcC399